CVE-2026-33679

Katalog CVE

CVSS 7.4 · High EPSS 0,45%

Kerentanan Server-Side Request Forgery (SSRF) pada vikunja. Skor CVSS 3.1 7.4 (High) menurut NVD.

Deskripsi (NVD)

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go` uses a bare `http.Client{}` with no SSRF protection when downloading user avatar images from the OpenID Connect `picture` claim URL. An attacker who controls their OIDC profile picture URL can force the Vikunja server to make HTTP GET requests to arbitrary internal or cloud metadata endpoints. This bypasses the SSRF protections that are correctly applied to the webhook system. Version 2.2.1 patches the issue.

Rincian

Terbit di NVD

24 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g9xj-752q-xh63 exploit · advisory vendor
• https://github.com/go-vikunja/vikunja/commit/363aa6642352b08fc8bc6aaff2f3a550393af1cf patch
• https://vikunja.io/changelog/vikunja-v2.2.2-was-released release notes